However, this multi-party processing introduces new vulnerabilities and attacks because of the untrusted environment. More specifically, when the trained model is split and distributed among different helpers, an untrusted device can recover the input fed by the previous helper, even if it does not have complete information about the model structure. In this context, authors in [1]} introduced different possible attacks against collaborative inference, including black-box attacks. In black-box settings, the malicious participant only has knowledge about his segment and attempts to design an inverse DNN network to map the received features to the targeted input and recover the original data. Authors showed that reversing the original data is possible, when the neural system is split at shallow layers as proposed in [2]}. Hence, an intuitive technique is to split the DNN after the fully connected layers, owing to their ability to mix the input and hide the sample features. Yet, this
may not be adequate to all IoT nodes, where devices have limited resources (e.g., sensors) and cannot execute a high number of complex layers. Many other countermeasures have been considered to strengthen the robustness of deep networks, including the differential privacy, which suggests adding noise to the intermediate outputs to blur or obscure it. However, performing classification on corrupted data may decrease the accuracy of the system. A similar technique to secure the distributed environment is to encrypt the data before inference in order to guarantee the non-leakage of the private information. An obvious drawback of such approach is that it suffers from learning inefficiency, requires additional computation, and cannot be applicable to all DNN networks nor supported by all IoT devices.
